Office Security City of York Council Internal Audit Report 2016/17

Business Unit: Customer and Corporate Services Responsible Officer: Assistant Director Legal and Governance Service Manager: Head of Property Design and Facilities Management Date Issued: 20/2/2017 Status: Final Reference: 10425/001

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction West Offices are now the Council’s main offices, having opened in 2013 following a major renovation project.

The building houses the majority of Council staff, as well as several third party organisations. It is also the main point of contact for York residents, with a Customer Centre handling enquiries. Ensuring the safety of members of staff and the premises is therefore very important in creating an effective working environment.

This is the first time that the area has been audited since the move in 2013.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that:

• Policies and procedures were adequate to manage risks, were reviewed regularly to keep them up to date and were readily accessible to relevant staff • Access to the building was sufficiently controlled to prevent unauthorised access • Technical security (e.g. CCTV) was managed in accordance with procedures and was maintained correctly • Incidents were logged, managed and escalated in accordance with Council procedures

The audit did not consider security at any other Council premises.

Key Findings Overall, the processes in place for ensuring the security of West Offices are operating effectively. Incidents are well managed and resolved promptly and there is clear evidence of the Facilities and Security teams planning ahead to deal with potential security issues. Furthermore, procedure notes are reviewed regularly to ensure they are up to date and the process for deactivating staff passes is working effectively to prevent unauthorised entry by former staff members.

There were, however, five issues arising from the audit, of which three are now being dealt with by the relevant service area(s). The main issue identified related to the criteria for accepting requests for new staff passes and inductions to West Offices. Sample testing and discussion with the service area suggests that line managers do not always know who to contact regarding inductions and issuing of passes, the criteria for accepting a request are not fixed and that documentation is not always completed or retained.

Although it is not thought that anyone has acquired a staff badge improperly, the process for accepting requests for staff badges and inductions could be formalised and communicated with relevant Council and partner organisation employees.

Other minor issues found during the audit include the high proportion of missing visitor passes and the number of visitors who do not sign out; that the process for collating and retaining visitor logs is unclear; that several contractor passes were missing; and that CCTV maintenance at West Offices is not formally included in the maintenance contract. These issues are discussed in more detail in the findings below.

**Overall Conclusions**

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Requests for Staff Passes & Inductions

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The process and criteria for accepting requests for inductions and staff passes are unclear and documentation is not always retained. | Unauthorised persons may receive staff passes for or inductions to West Offices, possibly leading to theft; harm to staff, members of the public or the premises; or financial or reputational damage to the Council. |

Findings

Sample testing and discussion with the service area suggests that line managers do not always know who to contact regarding inductions and issuing of passes, the criteria for accepting a request are not fixed and that documentation is not always completed or retained.

For example, discussion with the service area established that, when requests for passes and inductions are received, an email signature or other indicator is looked for to establish that the individual is suitable to make the request. Of twenty new starters selected, authorisation could be found for only seven of them. There were also two examples of individuals using external email addresses (i.e. not Council or partner organisations) to contact Facilities Management to arrange for an induction and staff passes directly, rather than these requests coming from officers already based at the Council. One example was found of an individual emailing the Workforce Development Unit to arrange an induction and one of another individual who contacted Facilities but said they were not sure if they were contacting the right team.

Although it is not thought that anyone has acquired a staff badge improperly, the process for accepting requests for staff badges and inductions could be formalised and communicated with relevant Council and partner organisation employees.

Agreed Action 1.1

Information will be made available on the Council’s Intranet regarding the process for arranging staff passes and inductions for new starters. A form will be designed that will be completed for inductions and will be signed by the line manager.

| Priority | 3 | |----------|---| | Responsible Officer | Facilities Manager | | Timescale | 17/2/2017 |

## 2 Visitor Passes

| Issue/Control Weakness | Risk | |------------------------|------| | Many of the visitor passes are missing and a significant number of visitors do not sign out. | Visitors may gain unauthorised access to West Offices potentially leading to theft; harm to staff, members of the public or the premises; or financial or reputational damage to the Council. |

### Findings

A spot-check carried out on 7th November 2016 found 72 out of 200 passes were missing and, during the period tested, 11% of visitors did not sign out (and, therefore, presumably did not return their passes). Discussion with the service area confirmed they are aware of the issue and have raised it with Customer Centre staff. However, no action has been taken to retrieve the missing passes.

Although the visitor passes cannot be used to unlock doors in West Offices, it is possible that attempts could be made to gain unauthorised access by bluffing or tailgating through doors.

### Agreed Action 2.1

A reminder will be issued to reception staff regarding ensuring visitor passes are returned. I-comply will be issued to all staff regarding security and visitors on 6/2/2017. There are also a number of other possible actions being discussed with the Customer Service Team Manager (LA).

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Facilities Manager | 31/3/2017 | 3 Document Retention

| Issue/Control Weakness | Risk | |------------------------|------| | The process for collating and retaining visitor logs is unclear. | Non-compliance with the Council’s document retention policies. |

Findings

The process for collating and retaining visitor logs was also found to be unclear. Currently, visitor logs are being sent from the Customer Centre to the Security Office, before finally being sent to Business Support for scanning. Discussion with relevant officers suggests that there is no need for them to go to Security; they could simply go straight to Business Support. They are also being sent irregularly and not in date order.

The process would therefore benefit from a review to establish retention periods and how often logs should be sent for scanning.

Agreed Action 3.1

Daily visitor logs will be clipped together, kept in a drawer in date order, and sent for scanning on a weekly basis in an envelope marked with the date. This will commence from 13/1/2017. Paper copies of the visitor logs will be retained for three months and electronic records for two years.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Customer Service Team Manager (LA) | Implemented |

### 4 Contractor Passes

| Issue/Control Weakness | Risk | |------------------------|------| | Some contractor passes were missing and not all staff members were signing the logs to confirm that contractors had signed out and returned their pass. | Contractors may gain unauthorised access to West Office, potentially leading to theft; harm to staff, members of the public or the premises; or financial or reputational damage to the Council. |

### Findings

Contractor logs were signed by the staff member on duty in only 68% of cases to confirm that the contractor's pass had been returned and a count of the passes confirmed that 3 out of 10 were missing.

As a result of the work carried out during the audit, the service area changed the process for issuing contractor passes. All 10 passes were cancelled and re-issued by Security. Five passes are now kept in the Goods Entrance, with the other five kept in the Security Office. Facilities are now providing a log to Security at the end of each working day to confirm whether or not all the passes have been returned. Security has said they will chase up any outstanding passes or, if they are missing, cancel the pass and contact the contractor.

A follow-up will be required to ensure that the new daily log is working effectively.

### Agreed Action 4.1

Contractor passes have been reissued and five are now kept in the Security office. The Facilities team are providing Security with a log at the end of each working day to confirm whether or not all passes have been returned.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Facilities Manager | Implemented | 5 CCTV Management and Maintenance

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | CCTV maintenance at West Offices is not formally part of the Council’s contract with the maintenance contractor. | If technical security (e.g. CCTV) is not managed or maintained, this may lead to breaches of security should there be a gap in coverage. |

Findings

Overall, testing shows that CCTV checks are carried out daily; issues are being logged in the Incident Log and reported when necessary. However, not all issues are being resolved within contract timescales.

The CCTV Manager explained that CCTV maintenance at West Offices was not formally written into the contract when the Council moved into West Offices. However, CCTV was already in use and an arrangement needed to be agreed. Therefore, an agreement was reached with the existing contractor to provide CCTV maintenance at West Offices to the same standards as Public Space Surveillance (PSS). As part of the procurement process for CCTV maintenance, West Offices will be fully integrated into the contract put out to tender.

It is therefore considered a priority to integrate West Offices CCTV into the new contract and ensure a financial waiver is in place for the remainder of the 2016-17 financial year.

Agreed Action 5.1

A financial waiver is being put in place and CCTV maintenance at West Offices will be integrated into the new CCTV contract.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | CCTV Manager | Implemented | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |-----------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.